forked from linux/documentation
165 lines
5.6 KiB
Markdown
165 lines
5.6 KiB
Markdown
# RDP Remote Access with XRDP
|
|
|
|
The basic configuration in Hiera is:
|
|
|
|
```yaml
|
|
xrdp::enable: true
|
|
```
|
|
|
|
## Remote Access Modes
|
|
|
|
### Terminal Server Mode
|
|
|
|
By default XRDP runs in terminal server mode where only virtual desktop sessions are available.
|
|
The explicit configuration would be:
|
|
|
|
```yaml
|
|
xrdp::mode: 'virtual_desktops_only'
|
|
|
|
```
|
|
### Access to Physical Desktop
|
|
|
|
!!! warning
|
|
Accessing to your/a real physical desktop session causes a security risk with people having physical access to the workstation. They can see on the real monitor what you are doing and interfere with keyboard and mouse. It is similar as if you are away from the workstation and have the screen unlocked.
|
|
|
|
Note that due to technical limitations it is only possible to access the primary screen in multi-monitor setups.
|
|
|
|
For accessing the physical desktop there are three different modes supported:
|
|
|
|
```yaml
|
|
xrdp::mode: 'access_users_physical_desktop_or_fallback_to_virtual_desktop'
|
|
```
|
|
|
|
This allow to access to currently running desktop of the accessing user or, if none exists, creates automatically a virtual desktop.
|
|
Note that you should log out of the virtual desktop before logging in again on the physical desktop.
|
|
But it is fine to have multiple different users running own virtual desktops as long as they are different to the one using the physical desktop.
|
|
|
|
```yaml
|
|
xrdp::mode: 'access_physical_desktop_of_whatever_user_logged_in'
|
|
```
|
|
This mode is for the case where a shared account (GAC-account or e-account) is used e.g. on a console. Whoever has permissions to log into this computer can see and interact with the physical desktop, independent of the actual user which runs the desktop session.
|
|
|
|
In this and only this mode you can even access the login window of the session manager `gdm`. Note that you cannot login with your own account, you need to use another one, e.g. the GAC-account. After successful login you connection terminates as the `Xorg` session of `gdm` terminates too. But if you connect again you get access to the new desktop session.
|
|
|
|
There are no virtual sessions possible in this mode.
|
|
|
|
```yaml
|
|
xrdp::mode: 'user_selects_physical_or_virtual_desktop'
|
|
```
|
|
If you or your users can make an informed decision if they want to use a virtual session or access the physical session then you can give offer them the selection using this mode.
|
|
|
|
## Automatically Close Sessions
|
|
If you may want that the users cannot keep their desktop sessions open forever, you may configure their sessions to be closed after they have been disconnected for some time (seconds). The default value is `0` which disables this feature.
|
|
|
|
```yaml
|
|
xrdp::disconnected_session_timeout: 3600
|
|
```
|
|
|
|
|
|
## Legacy Settings
|
|
|
|
These settings apply if one of the two Hiera keys below are set to `true` or `false`:
|
|
|
|
|
|
Allow to connect to a VNC server listening on `localhost:5900`:
|
|
```yaml
|
|
xrdp::shared_desktop::enable: true
|
|
```
|
|
|
|
Allow virtual desktop sessions:
|
|
|
|
```yaml
|
|
xrdp::virtual_desktop::enable: true
|
|
```
|
|
|
|
|
|
## "Unsupported" Settings
|
|
|
|
If you want to allow the same user to be able to open in parallel a local and a remote session then you can enable the systemd nest feature. Note that this is a hack and goes against the systemd design and thus this can lead to unexpected problems.
|
|
|
|
```yaml
|
|
xrdp::nest_systemd::enable: true
|
|
```
|
|
|
|
## Notes
|
|
- Changes are not automatically applided, it needs a restart of `xrdp` first (e.g. reboot or `systemctl restart xrdp`) which will close all running connections.
|
|
- Users that are only allowed to login locally to the system (i.e. with an entry like this `+:ebner-adm:LOCAL` in `/etc/security/access_users.conf`) cannot use RDP virtual sessions.
|
|
|
|
## Troubleshouting
|
|
|
|
### Gnome does not start despite proper login
|
|
If the log shows
|
|
```
|
|
xrdp-sesexec[3145015]: [WARN ] Window manager (pid 3145116, display 11) exited quickly (0 secs). This could indicate a window manager config problem
|
|
```
|
|
then there is probably a half dead Gnome session around.
|
|
Check with `loginctl` for such a session of given user and terminate it with
|
|
```bash
|
|
loginctl kill-session $SESSION_NUMBER
|
|
```
|
|
After Gnome should start properly again.
|
|
|
|
|
|
### Session Already Running
|
|
|
|
|
|
|
|
|
|
Systemd and Gnome do not really allow for more than one concurrent session for the same user.
|
|
|
|
Easiest solution: reboot/powercycle the machine.
|
|
|
|
Or somehow connect to the other session and close it (using RDP from a colleagues machine, etc.).
|
|
|
|
If you can log in with `ssh` you can also terminate the session from the shell:
|
|
|
|
```
|
|
[buchel_k@lxdev08 ~]$ loginctl
|
|
SESSION UID USER SEAT TTY STATE IDLE SINCE
|
|
11 44951 buchel_k pts/0 active no
|
|
13 44951 buchel_k seat0 tty2 active no
|
|
|
|
2 sessions listed.
|
|
[buchel_k@lxdev08 ~]$ loginctl kill-session 13
|
|
[buchel_k@lxdev08 ~]$
|
|
```
|
|
As seen above, physical sessions have a "seat", whereas the `ssh` session has a `pts` (pseudo terminal).
|
|
|
|
Virtual sessions do not have a "tty":
|
|
|
|
```
|
|
[buchel_k@lxdev08 ~]$ loginctl
|
|
SESSION UID USER SEAT TTY STATE IDLE SINCE
|
|
11 44951 buchel_k pts/0 active no
|
|
15 44951 buchel_k n/a active no
|
|
c3 42 gdm seat0 tty1 active no
|
|
|
|
3 sessions listed.
|
|
[buchel_k@lxdev08 ~]$
|
|
[buchel_k@lxdev08 ~]$ loginctl show-session 15
|
|
Id=15
|
|
User=44951
|
|
Name=buchel_k
|
|
Timestamp=Fri 2026-03-20 10:21:03 CET
|
|
TimestampMonotonic=59919783992
|
|
VTNr=0
|
|
Display=:11
|
|
Remote=yes
|
|
RemoteHost=::ffff:129.129.175.98
|
|
Service=xrdp-sesman
|
|
Scope=session-15.scope
|
|
Leader=95172
|
|
Audit=15
|
|
Type=x11
|
|
Class=user
|
|
Active=yes
|
|
State=active
|
|
IdleHint=no
|
|
IdleSinceHint=0
|
|
IdleSinceHintMonotonic=0
|
|
LockedHint=no
|
|
[buchel_k@lxdev08 ~]$
|
|
```
|
|
|
|
To kill a session of another user you need to be `root`.
|